A keyless entry system is a system to unlock a vehicle without actively using a car key, and to start a vehicle by merely operating the starter button, namely using a radio key that the vehicle driver carries. If only passive vehicle unlocking is possible, this is referred to as keyless entry.
When the user approaches the vehicle or e.g. touches the door handle of the vehicle, the device installed in the vehicle is woken and sends, to the radio key, a radio signal at a first frequency, preferably (but not necessarily) more likely at a low frequency of typically <300 kHz, which radio signal includes an encoded enquiry signal. The radio key decodes the enquiry signal, provides it with a new coding and transmits it again as a response signal on a second, preferably higher, frequency, for example one in the UHF band, as illustrated in FIG. 1. The device installed in the vehicle knows the coding scheme of the radio key, and if the response signal matches the response signal to be expected then the vehicle is unlocked.
A range of the radio signal at the first, preferably lower, frequency is restricted to a few meters, for the most part approximately 3 meters, so that only a radio key situated close to the vehicle can be woken or activated by the vehicle-based device.
A relay station attack (RSA) primarily extends the range of the radio signal at the preferably lower frequency using two relay stations, a first in proximity to the vehicle door and a second in proximity to the person who carries the radio key, as described below with reference to FIG. 2.
An attacker who carries the first relay station wakes the vehicle-based device, e.g. by touching the door handle, so that it sends the radio signal at the first frequency. This radio signal is received by the first relay station and sent thereby on the second (normally, but not necessarily, much higher) frequency to the second relay station, which converts it back into the original radio signal of the first frequency and sends it to the radio key.
The response signal of the radio key is normally strong enough to span the distance back to the vehicle, and opens the vehicle (what is known as the minor variant of the RSA). If the response signal of the radio key is not strong enough, the relay stations can provide a return channel that extends the range of the radio signal at the higher frequency (what is known as the major variant of the RSA).
DE 103 01 146 A1 discloses a method to secure a system for passive vehicle unlocking against relay station attacks. The vehicle-based device regularly monitors the natural RF signal level received by it and identifies a relay station from interference in the natural RF signal level, which interference is identified by a noise test.
US 2016/0200291 A1 discloses a method to secure a system for passive vehicle unlocking against relay station attacks insofar as a low-frequency unidirectional and a high-frequency bidirectional radio link are provided. It is thus possible for noise signals to be identified that any relay stations have added to the radio signals.
US 2013/0078906 A1 describes a method to secure a radio link between a transmitter and a receiver, also for remote-controlled opening of a vehicle, against relay station attacks, the intervention of relay stations being identified on the basis of the effect thereof on the noise in the signal received by the receiver. To this end, characteristic noise parameters are extracted and compared with a reference noise signal.
The known methods for preventing relay station attacks are not invulnerable, and therefore the disclosure is based on the object of specifying a more reliable method to secure a system for passive vehicle unlocking against relay station attacks.